Skip to main content
ITISYOU
Menu
In developmentIn development — private

Build

A governance platform that won't call a project done until the evidence says so — including about itself.

Build is a private, in-development platform for software project governance: lifecycle, requirements traceability, impact analysis, budgets and capacity, and evidence-gated approvals. By standing instruction it is not deployed to production until its own V1 gates genuinely pass.

Where it stands

In development, private, and not released. The owner's standing instruction is not to deploy Build to production until its own V1 gates genuinely pass, and today they do not.

Last verified

Private — there is no public address, by design.

What it is, in plain terms

Build is a private, in-development platform for governing software projects — not writing code, but keeping track of what a project actually is, is supposed to be, and has evidence of being. It records a project's lifecycle from an idea through delivery, keeps requirements linked through to the design, work and tests that satisfy them, works out what else is affected when one part of a project changes, tracks budgets and capacity against the plan, and only lets a stage advance when the evidence a gate demands genuinely exists rather than when someone has said it does.

It is not a general project-management tool with a governance label attached; the governance is the point, and most of what the platform does is in service of being able to say, honestly, whether a project is where it claims to be. It is not released. There is no public address to visit, and by the owner's own standing instruction, it will not be deployed to production until it can pass the same evidence-gated standard it applies to the projects it tracks — which, as of today, it cannot yet.

Why I built it

I wanted to find out whether the discipline that "evidence-gated" implies could actually survive being applied to a real, growing piece of software, including the software doing the applying. It is easy for a status report to describe a project as further along than it is — a form gets filled in, a checkbox gets ticked, and nobody goes back to check the evidence behind it actually exists. I wanted a platform that structurally could not do that: where a gate that asks for evidence only passes when evidence is attached, where a requirement that cannot be traced to a test says so rather than being silently dropped, and where the platform's own account of its own progress is held to the same rule.

Partway through, the project’s own phase history read as though the platform were nearly finished. It was not, and working out exactly how not — measured, not guessed — became as much the point of the project as the platform itself.

The problem underneath

Software governance tools tend to fail in a specific way: they get very good at recording what people say is true, and offer nothing that checks whether it is. A gate marked "evidence attached" can mean a genuine artefact was reviewed, or it can mean a text field was typed into once and never revisited. A requirement marked "verified" can mean a test actually exercises it, or it can mean somebody believed it did.

The gap between those two things tends to be invisible until something goes wrong, at which point the record turns out to have been agreeing with itself the whole time rather than with reality. Build's starting question was whether that gap could be closed structurally — by making a gate's pass condition the existence of a real artefact rather than a claim about one, and by measuring the platform's own progress the same way, including when the honest number is worse than the one previously on record.

How it works, without the jargon

In practice, a project inside Build moves through a defined set of lifecycle states, and moving between them is validated centrally rather than left to whichever screen happens to be doing the moving. Requirements are recorded and linked forward through the design and work that is meant to satisfy them and the tests meant to verify them, so a chain that breaks — a requirement nothing tests, say — is reported as broken rather than quietly treated as complete.

A change to one part of a project — an architecture component, say — is traced through to the other things that depend on it, so that "nothing else depends on what you changed" is a computed answer rather than an assumption. Gates that require evidence or a recorded approval check for an actual artefact — a document, a decision, a file — rather than a form field asserting one exists. Everything that changes a project writes an audit record in the same transaction as the change itself, so the audit trail cannot end up describing a different set of events from what actually happened.

What building it taught me

The clearest lesson was how often a defect hid behind a test that looked correct. More than once the automated suite passed cleanly while the feature it was meant to cover did not work at all — because the test asserted something true about a fixture that was not true about the real system, or because a check that should have failed loudly instead returned an empty, confident answer that looked like success.

Several of the more serious problems only became visible by actually rendering a page, or actually sending many requests at once against a real deployment, rather than by reading code or running a unit test in isolation. That reordered my sense of what "tested" should mean here: a green suite is necessary and nowhere near sufficient, and some of the most important checks in this project are the ones that run against something closer to the real thing — a pre-production deployment, a restricted database role, concurrent load — rather than a fast, isolated fixture.

The other lesson was about scale: closing one gap in the requirements traceability made a different page too large to read reliably, which is its own kind of regression that a passing test suite does not notice.

Where it stands today

Build is in development, private, and not released. Its lifecycle engine, evidence and approval recording, requirements traceability, change-impact analysis and audit writing are implemented and have been checked against a real pre-production deployment, not just against unit tests, and 2,364 unit tests pass at the project's latest commit.

Against its own V1 specification, though, a large-scale review — each finding checked by a second, independent pass whose job was to try to disprove it — found 118 gaps that survived, 29 of them treated as blockers. Some of the platform's most serious defects, including one that could have let one organisation see another's data under a pooled database connection, have been found and fixed since that review, and the fixes are now checked as standing release gates.

The owner's standing instruction is that Build is not deployed to production until the V1 gates genuinely pass, and by the platform's own honest accounting, they do not yet.

Where it may go

Next: close the remaining items in the V1 gap register in the priority order the owner has set, working from the ones that block a gate outward. Then: get the full automated test suite — now well over a thousand end-to-end tests alone — running reliably inside its time budget as a matter of course rather than something that needs active shepherding. Later, if the V1 gates genuinely pass on their own evidence rather than on a description of them passing: deploy Build to production for the first time.

None of this is scheduled against a date; it is described here as the order the remaining work is intended to happen in, because that is what the project's own records commit to.

For developers: the tenant-isolation and concurrency defects, and how the gap register was produced

The platform's identity-scoping defect is worth describing in a little more detail because of how it hid. Under a pooled database connection, a mechanism intended to say "these queries act as this organisation" was set and cleared at the level of the connection rather than the individual unit of work, which is correct only when a connection never serves more than one caller — true of the development database used in most testing, and false the moment connections are shared under load. The fix moves that mechanism inside an explicit transaction boundary using a construct that is automatically discarded when the transaction ends, whichever way it ends, so a connection handed back to a pool never carries an identity from the request that used it last.

The concurrency defect that made a deployed service hang had a similar shape: a database connection was memoised at a scope wider than the individual request, on infrastructure where holding a connection open across requests is not the architecture's job — a separate pooling layer sits below it precisely so the application does not have to hold its own pool. The fix opens and closes a connection per unit of work, which would be poor practice against a bare, unpooled database and is the correct shape here, because the pooling problem is already solved one layer down.

The 118-item gap register was produced by a large parallel review: each finding was made by one independent pass, then handed to a second, independent pass whose task was specifically to try to refute it, with uncertain findings defaulting to refuted rather than counted. That asymmetry — a finding has to survive an attempt to disprove it, not merely be asserted — is deliberate, and is the same standard the platform tries to apply to the projects it governs.

A number of the platform's more serious defects were only found by running something against real infrastructure rather than by reading code or running a fast, isolated test — concurrent requests against a genuine deployment, a database role that cannot bypass access rules, an actual accessibility-tree walk over a rendered page at real size. Each of those is now a standing check rather than a one-off investigation, on the view that a defect found once by an unusual method will be found again by the same method if nothing keeps checking for it.

How it works

Can a governance platform for software projects hold itself to the same evidence standard it demands of the projects it tracks?

The loop, step by step

  1. A project is entered and given a lifecycle state
  2. Requirements are recorded and linked through to the work that satisfies them
  3. A change to one part is traced through to what else it affects
  4. Budgets and capacity are tracked against the plan
  5. Evidence is attached and checked against gate criteria before a stage can advance
  6. A release is only marked ready once its gates — not just its code — pass

The principle underneath

Evidence-gated, including for itself

A stage of a project's lifecycle only advances when the evidence a gate demands actually exists, not when a form has been filled in describing it. The same standard is applied to Build's own progress: its own record of what remains lists 118 gaps against its own V1 specification, rather than describing itself as further along than it is.

What exists today

Implemented in the current code. Nothing here is a plan.

  • lifecycle

    A real project lifecycle

    Twelve lifecycle states and twelve edges between them, with central validation, covering all ordered pairs in the project's own automated tests.

  • evidence-gates

    Evidence and approvals are real records

    Gate criteria that require evidence or an approval can now be satisfied, and are checked against artefacts actually attached to a project rather than against a checkbox.

  • traceability

    Requirements trace through to what verifies them

    A requirement is followed through design, work and test, and a broken chain is reported as broken rather than silently skipped.

  • impact-analysis

    Change impact is computed, not guessed

    A change to one part of a project is traced through to the other parts — budgets, tests, deployments — that depend on it.

  • audit

    Actions are written to an audit trail

    A change to a project writes an audit event in the same transaction as the change itself, rather than as a separate, skippable step.

  • self-reporting

    Its own gaps are tracked in the open

    A register of what does not yet meet the V1 specification is kept, rather than quietly closed as the phases proceed.

What was verified

Each result carries the weight its level allows and no more. These are the project's own records of itself — nobody else has reproduced them.

DemonstratedRun on the verified device and observed to work.
  • A pre-production deployment reflecting the current lifecycle, evidence and audit work has been verified

    Lifecycle transitions, evidence-gated approvals and audit writes were each checked against a real pre-production deployment, not just unit tests.

TestedCovered by automated or repeated manual testing.
  • 2,364 unit tests pass

    Recorded in the project's handoff record at its latest commit.

  • The tenant-identity defect under pooled connections is fixed and gated

    The pre-fix behaviour measured 18 of 40 concurrent requests answered under the wrong identity; the fixed version measures 40 of 40, and the check now runs as a release gate.

  • The guest-project access gap is closed

    Every guest session now carries its own scoped identity, and the fix is checked under a database role that cannot bypass the platform's access rules.

LimitedShown only under specific conditions, stated alongside it.
  • The full end-to-end browser suite runs reliably inside its time budget

    The suite has been split into parallel shards to fit the budget; each individual shard is checked, but the suite continues to grow and needs to be watched rather than treated as settled.

Not claimedExplicitly outside what this prototype does or asserts.
  • V1 is complete

    118 gaps against the platform's own V1 specification are recorded as open, 29 of them treated as blockers.

  • Build is deployed to production

    By the owner's standing instruction, production deployment waits until the V1 gates genuinely pass; it has not been deployed.

Rules it holds to

Decisions made on purpose, so none of them has to be inferred from silence.

A gate's evidence requirement is not met
The stage does not advance, regardless of what other work has been completed around it.
The V1 gates have not genuinely passed
Build is not deployed to production, by standing instruction from the owner.
A test would need to be weakened to pass
The underlying defect is fixed instead; a weakened test is treated as a worse outcome than a failing one.
Two organisations share infrastructure such as a pooled database connection
Identity is scoped to the individual transaction, not the connection, so one cannot see another's data.

Not deployed to production

A verified pre-production deployment exists; the live production environment does not, by the owner's own instruction, until the V1 gates pass.

Private, not for general use

There is no public address, no sign-in, and nothing to try.

Its own honesty is tested

The project's gap register exists because its own phase history read as though the platform were nearly finished, and it was not. The register was written to correct that, and it is kept up to date as gaps close.

Problems and lessons

Real problems from the project's own records, with what was found, what changed and how it is checked now.

  1. 01

    A pooled database connection could answer under the wrong organisation's identity

    What was found
    A test against a pre-production deployment found that when database connections were pooled and reused across requests, 18 of 40 concurrent requests were answered with another organisation's identity attached, because the mechanism that set which organisation a connection was acting for was scoped to the connection rather than to the individual piece of work.
    What changed
    Identity is now set and cleared inside the same transaction as the work it applies to, so it cannot outlive that transaction or leak onto a connection handed back to the pool.
    How it is checked now
    The fixed version was measured at 40 of 40 requests answered under the correct identity, and the check now runs as a standing release gate rather than a one-off test.
  2. 02

    The deployed service hung under concurrent load

    What was found
    Concurrent requests to a basic health check produced a mix of hangs and correct responses, traced to a shared connection being reused across requests running on different underlying workers, one of which had not opened it.
    What changed
    The deployed code now opens a connection for each piece of work and closes it afterwards, relying on a separate pooling layer designed for that job rather than holding one connection in shared memory.
    How it is checked now
    A single request against the service had looked fine on its own; the fix was verified by sending many requests at once against a real deployment, which is now how the check is run.
  3. 03

    Guest, unregistered projects were not actually walled off from being seen by other tenants

    What was found
    A guest project's ownership was recorded in a way that quietly placed it outside the reach of the platform's row-level access rules altogether, rather than restricting it to its own guest session, which had gone unnoticed because the roles used for everyday testing were exempt from those rules.
    What changed
    Every guest session was given its own scoped identity, so the same access rules that cover a registered organisation's data cover guest data too, without adding a second, separate mechanism.
    How it is checked now
    Switching the test role to one that cannot bypass the access rules made the gap immediately visible, and the fix is now checked under that same restricted role.
  4. 04

    The end-to-end browser test suite outgrew its own time budget

    What was found
    As the product grew, the full browser test suite reached over a thousand tests across five browsers and stopped finishing inside its allotted continuous-integration time, so some runs were stopped with tests still queued.
    What changed
    The suite was split into parallel shards so it completes within budget, and the time limit itself was kept rather than loosened, because it is what made the suite's growth visible in the first place.
    How it is checked now
    Each shard is checked to finish comfortably inside the limit, rather than assuming more shards alone solved it.

Limits and unknowns

What it does not do, and what it is not — stated here rather than discovered later.

Limitations

  • Not released, and not deployed to production — by standing instruction, until its own V1 gates genuinely pass.
  • 118 gaps remain open against the platform's own V1 specification, 29 of them treated as blockers.
  • Continuous integration has not reliably run fully green at the platform's current size; the end-to-end suite has needed active management to stay inside its time budget.
  • There is no public address, no sign-in and nothing to try.
  • Results and test counts are the project's own measurements, run on infrastructure the project itself controls.

What it is not

  • Not deployed to production — by the owner's own standing instruction, production waits until the V1 gates genuinely pass.
  • Not finished against its own V1 specification — 118 gaps are recorded as open, 29 of them blockers.
  • Not a public product — there is no public address, no sign-in, and nothing to try.
  • Not independently audited — every result above is the project's own measurement of itself.
  • Not a claim that the platform is further along than its own gap register says — an earlier, overstated version of that claim was corrected in this project's own records.

Where it may go

Directions the project's own plans record. Intentions, not promises — and not dates.

  1. Next: close the remaining blockers in the V1 gap register, in the owner's stated priority order
  2. Then: get continuous integration reliably green at the current size of the automated test suite
  3. Later, if the V1 gates genuinely pass: deploy to production for the first time

Technical detail

For developers. Nothing here is needed to understand the rest of the page, and nothing here is an address, a port or a path.

Identity is scoped to the transaction, not the connection

Setting which organisation a database connection is acting for is done inside the same transaction as the work, using a mechanism that is automatically discarded when the transaction ends, whether it commits, rolls back, or the connection is dropped.

A restricted database role is part of the test, not just the deployment

Access-control checks are run under a role that cannot bypass the platform's row-level rules, because running them as a role that can bypass those rules would pass for the wrong reason.

Requirements are checked by the method their own rule already implies

Rather than hand-classifying how each requirement should be verified, or guessing from keywords, the verification method is derived from what the rule that produced the requirement already states.

A fingerprint guards schema drift

The running service checks a fingerprint of the database structure it expects against the one it finds, and refuses to serve against a schema it does not recognise, rather than failing unpredictably later.

Gaps were found by an adversarial process

The 118 recorded gaps came from a large-scale analysis of the platform's own specification against its implementation, where every finding was checked by a second, independent pass whose job was to try to refute it.

What this is based on

Sources for this page

  • Build repository, handoff record and gap register — inspected directlyprivate source — described, not linked

    The handoff record, development story, known-issues register and V1 gap register were inspected at the latest commit of 5 September 2026. They record 2,364 unit tests passing, a verified pre-production deployment, 118 open gaps against V1, and a standing instruction not to deploy production until the V1 gates genuinely pass.

    Checked 11 September 2026

This rests on private records — the project's repository, test results and engineering history, inspected directly. There is deliberately nothing public to check. If anything here turns out to be wrong, the corrections page explains how it gets fixed.